CVE-2026-15059

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

CVE-2026-15059

The CVE concerns systemd-oomd, where local unprivileged users can terminate arbitrary local processes via the systemd-oomd IPC API due to missing path traversal validation. Affected component: systemd-oomd IPC interface; root cause: lack of validation on paths in IPC calls. Impact: potential for ...

CVE-2026-15059

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

CVE-2026-18370

The CVE-2026-18370 entry details a heap-based buffer overflow in the entr utility, triggered in run_utility(). The code allocates a heap buffer via malloc(ARG_MAX) and copies command-line arguments into it, advancing the destination using the return value of strlcpy() (which reports the source le...

AZL-95225 CVE-2026-68083 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

CVE-2026-68083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

CVE-2026-68084

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

CVE-2026-68083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

UBUNTU-CVE-2026-68083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

CVE-2026-68416 mtd: fix double free and WARN_ON in add_mtd_device() error paths

In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARNON in addmtddevice error paths When deviceregister or mtdnvmemadd fails inside addmtddevice for a partition, the error handling triggers mtdrelease via putdevice or deviceunregister. mtdrelease calls...

EUVD-2026-55601

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

CVE-2026-68413 wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100pciinitone The memory allocated in the ipw2100allocdevice function is not freed in some of the error paths in ipw2100pciinitone. Fix that by converting the direct return into a...

CVE-2026-68412

The CVE-2026-68412 affects the Linux kernel’s wireless subsystem, specifically the cfg80211_wext_siwscan() error path. If the IEEE80211_MAX_SSID_LEN test fails, the request (creq) could leak due to improper error handling. The fix uses the existing error handling path to prevent the leak. No expl...

CVE-2026-68412 wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

CVE-2026-68410 wifi: libertas: fix memory leak in helper_firmware_cb()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

CVE-2026-68405

CVE-2026-68405 (Linux kernel, wifi/mac80211) describes a bug where AP_VLAN bc_buf SKBs could be freed outside the IRQ lock. During ieee80211_do_stop(), AP_VLAN packets are removed from ps->bc_buf while ps->bc_buf.lock is held with IRQs disabled, then ieee80211_free_txskb() is called after r...

CVE-2026-68405 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

CVE-2026-68403

The CVE concerns the Linux kernel driver brcmfmac SDIO path. In brcmf_sdio_probe(), the newly allocated bus is stored in sdiodev->bus before the ordered workqueue is initialized. If allocation fails, the path can reach brcmf_sdio_remove(), which unconditionally cancels bus->datawork. The bu...

CVE-2026-68403 wifi: brcmfmac: initialize SDIO data work before cleanup

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

EUVD-2026-55589

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...